Extracted

• • Target

    OC DDLP__ 241119L2.exe

  • Size

    633KB

  • MD5

    dab54091cf97a80110322dd3811d0216

  • SHA1

    4c1d2655af7becbf69562fb70435b202699a259f

  • SHA256

    9184270c4570753191b6820560106d8c7dfdaed6e083ab4f5dfe1d0af71ac8bc

  • SHA512

    dc77cc35d7f84f95e2cc6af4230b1c25c6006570e6a12d349beb14cfee75f0f03f5af295cba8093850bcebe7409fbb6d6081f4354e0a4abfda9aff8257608741

  • SSDEEP

    12288:BOv5jKhsfoPA+yeVKUCUxP4C902bdRtJJPitMMMMMMMMMMMMMMMMMMMMMMMMMMM0:Bq5TfcdHj4fmbaMMMMMMMMMMMMMMMMMw

  Score

  10^/10

  agenttesladiscoverykeyloggerspywarestealertrojanupx

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2